Apache SkyWalking BanyanDB: Improper authorization in Canopy monitoring proxy
Summary
Apache SkyWalking BanyanDB 0.11.0 before 0.11.1 does not enforce the readonly role on the /monitoring/* proxy of the Canopy web console. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the proxy. The default configuration is not affected. NVD lists a CVSS score of 9.1, while Rapid7 rates it 5.7 (Medium), and the description suggests the score is overstated for most deployments.
Affected
- Apache SkyWalking BanyanDB 0.11.0 before 0.11.1
- Default configuration: not affected
Fixed in
- Upgrade to Apache SkyWalking BanyanDB 0.11.1
Workaround
- No vendor-documented workaround. The vendor recommends upgrading to 0.11.1.
- Avoid the non-default combination of a readonly Canopy user and a reachable monitoring target.
- Restrict network access to the Canopy endpoint and limit readonly accounts.
Exploitation
- No known exploitation in the wild, no CISA KEV entry and no public proof of concept at the time of research.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS 0.00151.
Our recommendation
- Check whether any BanyanDB or Canopy instance runs version 0.11.0 and upgrade it to 0.11.1.
- If Canopy is reachable from the internet or untrusted networks, restrict access immediately.
- Confirm that no readonly accounts are used together with a monitoring target.
- Monitor the Apache advisory and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread lists.apache.org
- oss-security post CVE-2026-85499 www.openwall.com
- Vulners CVE record vulners.com
- OpenCVE CVE-2026-85499 app.opencve.io
- BanyanDB release v0.11.1 github.com
- BanyanDB pull request 1330 github.com
- Rapid7 record via Vulners vulners.com
- Flatcar security triage issue 436 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:55.
Original description (NVD)
Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy. This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.